Privacy Policy

1. Who controls the data

Laffa is responsible for personal data processing connected with operating the marketplace. Until the final legal entity registration is completed, the official contact details published in the service are the designated contact channel.

For legal questions or complaints: hello@laffa.ly.

2. Information we collect

• Account data: name, username, email, phone when enabled, profile image, and city.
• Verification data: identity, address, or KYC data where required; requested only for a defined purpose.
• Marketplace data: listings, photos/video, likes, follows, offers, Bundles, comments, and messages.
• Order data: address, delivery details, payment when enabled, tracking, disputes, and evidence.
• Technical data: security logs, device/browser, IP address, errors, and feature usage as needed for security and improvement.

3. Why we use data

• Create accounts, verify users, and provide buying, selling, and communication features.
• Handle orders, protection, returns, support, and fraud prevention.
• Comply with valid legal requests or protect legal/vital interests.
• Improve performance, search, and recommendations, with consent where needed for non-essential analytics.

4. Sharing

We do not sell user personal data. We share only what is necessary with hosting, email, security, permitted analytics, payment/courier providers when enabled, or competent authorities where a valid legal basis exists.

Public information such as username, profile image, closet, and comments may be visible to users and visitors as designed. Address, phone, and payment details are not public profile data.

5. Retention

We retain data while an account is active or as needed to provide the service, resolve disputes, prevent fraud, keep transaction records, or meet legal obligations. When no longer needed, it is deleted or de-identified where reasonably possible.

6. International processing

Laffa may use cloud, email, or security providers outside Libya. When data is processed outside Libya, we use providers and safeguards intended to provide an appropriate level of protection and limit data to what is necessary.

7. Security

We use technical and organizational safeguards such as access controls, encrypted connections, security logging, private-data separation, backups, and measures appropriate to the service. No electronic system can guarantee absolute security.

8. Your rights and choices

• Access available account data and correct it.
• Request deletion of the account and deletable data, except records that must be retained by law or for transactions/disputes.
• Control non-essential cookies through privacy preferences.
• Ask about processing or object to optional processing where available.

9. Age and changes

Laffa does not permit accounts for people under 18. If an underage account is identified, it may be restricted and non-required data deleted.

We update the effective date when this Policy changes and provide appropriate notice for material changes.